LGPD
Lei Geral de Proteção de Dados
Brazil followed the European model closely: consent as the rule, legal bases as a catalogue, the marketplace principle. If you are compliant in Europe you have most of it covered — but rarely the language.
LGPD at a glance
- In force
- Since 18 September 2020
- Supervision
- ANPD
- Penalty
- 2 % of Brazilian turnover, max. BRL 50 m per violation
- Model
- Consent before setting (opt-in)
What is the LGPD?
The Lei Geral de Proteção de Dados is Brazil's general data protection law. It follows the European template: ten exhaustively listed legal bases, comprehensive data subject rights and a dedicated supervisory authority, the Autoridade Nacional de Proteção de Dados.
Like the GDPR it applies beyond national borders: as soon as you offer goods or services to people in Brazil, or process data collected there, you are covered — regardless of where your company is based.
Who does the LGPD apply to?
Offering to people in Brazil
A Portuguese-language shop or shipping to Brazil is enough to fall within scope.
Processing data from Brazil
Merely processing data that was collected in Brazil triggers application as well.
Regardless of company size
Small businesses get procedural relief but are not exempt.
What does the LGPD require of a website?
Free and informed consent
Consent has to be purpose-bound, voluntary and provable — blanket agreements are not sufficient.
Information in the local language
Data subjects have to be able to understand the disclosures. For a Brazilian audience that means Brazilian Portuguese.
Withdrawal at any time
Withdrawal has to be as easy as granting, free of charge and through a simplified procedure.
Data subject rights
Access, correction, deletion, portability and information about disclosures — with response deadlines.
Reporting incidents
Security incidents involving risk have to be reported to the authority and to those affected.
How does Aiara meet the LGPD?
Brazil does not need a second solution — but it does need the right language and the same rigour as Europe.
Banner in Brazilian Portuguese
Aiara ships the banner in five languages, Portuguese among them. The language is chosen automatically from the browser setting or fixed.
Consent before setting
The same strict approach as under the GDPR: scripts load only after explicit agreement — which covers the Brazilian requirements too.
A provable record
Every consent is captured with time and scope. That record is exactly what the authority asks for in a review.
Withdrawal in one step
Permanent access to the settings satisfies the requirement for a simplified withdrawal procedure.
Granular purposes
Four separately switchable categories instead of one bundled agreement — which makes purpose limitation traceable.
Frequently asked questions about LGPD
Official sources
This page summarises the legal position in plain language and is no substitute for legal advice.